I have built a Mediawiki 1.42.3 on the latest version of Rocky9 and imported my database from a previous version. Everything works except (Open)LDAP login which returns an error when I try to login. The strange thing is that the error is different if I clear my cookie cash. I know that LDAP is working because I can login at the OS level using sssd. Is there any way to debug this as the logs give me no clue?
These are my LocalSettings.php LDAP settings:
######### LDAP ########
#######################
# LDAP Extensions
######################
wfLoadExtensions( [
'PluggableAuth',
'Auth_remoteuser',
'LDAPProvider',
'LDAPAuthentication2',
'LDAPAuthorization',
'LDAPUserInfo'
] );
$LDAPAuthorizationAutoAuthRemoteUserStringParser = 'username-at-domain';
$LDAPAuthentication2UsernameNormalizer = 'strtolower';
$LDAPAuthentication2AllowLocalLogin = true;
$wgAuthRemoteuserAllowUserSwitch = true;
$wgPluggableAuth_EnableLocalLogin = true;
$wgAuthRemoteuserUserName = function() {
$user = '';
if( isset( $_SERVER[ 'REMOTE_USER' ] ) ) {
$user = strtolower( $_SERVER[ 'REMOTE_USER' ] );
}
return $user;
};
$LDAPProviderDomainConfigProvider = function() {
$config = [
'acmecorp.com' => [
'connection' => [
"server" => "auth.acmecorp.com",
"user": "cn=readonlyroot,dc=acme,dc=corp",
"pass": "PASSWD",
"options" => [
"LDAP_OPT_DEREF" => 1
],
"basedn" => "dc=acme,dc=corp",
"groupbasedn" => "ou=group,dc=acme,dc=corp",
"userbasedn" => "ou=people,dc=acme,dc=corp",
"searchattribute" => "uid",
"usernameattribute" => "uid",
"realnameattribute" => "fullname",
"emailattribute" => "mail",
"grouprequest" => "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\GroupMember::factory"
],
'authorization' => [
'rules' => [
'groups' => [
'required' => [
'cn=readonlyroot,dc=acme,dc=corp'
]
]
]
],
'userinfo' => [
'attributes-map' => [
'email' => 'mail',
'realname' => 'fullname'
]
]
]
];
return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );
};
# In any case we need to specify LDAP domain configs
$LDAPProviderDomainConfigs = "$IP/../ldapprovider.json";
# Local login is enabled
$wgPluggableAuth_EnableLocalLogin = true;
$LDAPAuthentication2AllowLocalLogin = true;
$wgPluggableAuth_Class = "MediaWiki\\Extension\\LDAPAuthentication2\\PluggableAuth";
$wgPluggableAuth_ButtonLabel = "Log In (PluggableAuth)";
$wgPluggableAuth_Config['Log In (auth1.acmecorp.com)'] = [
'plugin' => 'LDAPAuthentication2',
'data' => [
'domain' => 'acmecorp.com'
]
];
# LDAP
wfLoadExtension( 'PluggableAuth' );
$wgPluggableAuth_EnableAutoLogin = false; #if true, disables the logout option
$wgPluggableAuth_EnableLocalLogin = true;
wfLoadExtension( 'LDAPProvider' );
$LDAPProviderDomainConfigs = "$IP/ldapprovider.json";
wfLoadExtension( 'LDAPAuthentication2' );
$LDAPAuthentication2AllowLocalLogin = true;
### EDIT EDIT ENABLE DEBUG LOGS
/**
* The debug log file must never be publicly accessible because it
* contains private data. But ensure that the directory is writeable by the
* PHP script running within your Web server.
* The filename is with the database name of the wiki.
*/
$wgDebugLogFile = "/var/log/mediawiki/debug-{$wgDBname}.log";
### ALSO turn on LDAP debug
$wgLDAPDebug = 99;
$wgDebugLogGroups['ldap'] = '/var/log/mediawiki/debug-ldap.log';
$wgShowExceptionDetails = true;
#$wgRevokePermissions['user']['createaccount'] = true;
# Prevent new user registrations except by sysops
$wgGroupPermissions['*']['createaccount'] = false;
## Forces user to login to view Wiki
## # The following permissions were set based on your choice in the installer
## $wgGroupPermissions['*']['createaccount'] = false;
## $wgGroupPermissions['*']['edit'] = false;
## $wgGroupPermissions['*']['read'] = false;
